<!DOCTYPE html>



  


<html class="theme-next gemini use-motion" lang="zh-Hans">
<head>
  <meta charset="UTF-8"/>
<meta http-equiv="X-UA-Compatible" content="IE=edge" />
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1"/>
<meta name="theme-color" content="#222">









<meta http-equiv="Cache-Control" content="no-transform" />
<meta http-equiv="Cache-Control" content="no-siteapp" />
















  
  
  <link href="/lib/fancybox/source/jquery.fancybox.css?v=2.1.5" rel="stylesheet" type="text/css" />







<link href="/lib/font-awesome/css/font-awesome.min.css?v=4.6.2" rel="stylesheet" type="text/css" />

<link href="/css/main.css?v=5.1.4" rel="stylesheet" type="text/css" />


  <link rel="apple-touch-icon" sizes="180x180" href="/images/apple-touch-icon-next.png?v=5.1.4">


  <link rel="icon" type="image/png" sizes="32x32" href="/images/xiehuan.png?v=5.1.4">


  <link rel="icon" type="image/png" sizes="16x16" href="/images/xiehuan.png?v=5.1.4">


  <link rel="mask-icon" href="/images/logo.svg?v=5.1.4" color="#222">





  <meta name="keywords" content="Spring,Java,Spring Security,安全," />










<meta name="description" content="Spring Security 学习中的一些记录">
<meta name="keywords" content="Spring,Java,Spring Security,安全">
<meta property="og:type" content="article">
<meta property="og:title" content="SpringSecurity">
<meta property="og:url" content="http://yoursite.com/2019/01/02/SpringSecurity/index.html">
<meta property="og:site_name" content="xiehuan">
<meta property="og:description" content="Spring Security 学习中的一些记录">
<meta property="og:locale" content="zh-Hans">
<meta property="og:image" content="http://yoursite.com/2019/01/02/SpringSecurity/1.png">
<meta property="og:updated_time" content="2019-01-22T07:59:55.578Z">
<meta name="twitter:card" content="summary">
<meta name="twitter:title" content="SpringSecurity">
<meta name="twitter:description" content="Spring Security 学习中的一些记录">
<meta name="twitter:image" content="http://yoursite.com/2019/01/02/SpringSecurity/1.png">



<script type="text/javascript" id="hexo.configurations">
  var NexT = window.NexT || {};
  var CONFIG = {
    root: '/',
    scheme: 'Gemini',
    version: '5.1.4',
    sidebar: {"position":"left","display":"post","offset":12,"b2t":false,"scrollpercent":false,"onmobile":false},
    fancybox: true,
    tabs: true,
    motion: {"enable":true,"async":false,"transition":{"post_block":"fadeIn","post_header":"slideDownIn","post_body":"slideDownIn","coll_header":"slideLeftIn","sidebar":"slideUpIn"}},
    duoshuo: {
      userId: '0',
      author: '博主'
    },
    algolia: {
      applicationID: '',
      apiKey: '',
      indexName: '',
      hits: {"per_page":10},
      labels: {"input_placeholder":"Search for Posts","hits_empty":"We didn't find any results for the search: ${query}","hits_stats":"${hits} results found in ${time} ms"}
    }
  };
</script>



  <link rel="canonical" href="http://yoursite.com/2019/01/02/SpringSecurity/"/>





  <title>SpringSecurity | xiehuan</title>
  








</head>

<body itemscope itemtype="http://schema.org/WebPage" lang="zh-Hans">

  
  
    
  

  <div class="container sidebar-position-left page-post-detail">
    <div class="headband"></div>

    <header id="header" class="header" itemscope itemtype="http://schema.org/WPHeader">
      <div class="header-inner"><div class="site-brand-wrapper">
  <div class="site-meta ">
    

    <div class="custom-logo-site-title">
      <a href="/"  class="brand" rel="start">
        <span class="logo-line-before"><i></i></span>
        <span class="site-title">xiehuan</span>
        <span class="logo-line-after"><i></i></span>
      </a>
    </div>
      
        <p class="site-subtitle"></p>
      
  </div>

  <div class="site-nav-toggle">
    <button>
      <span class="btn-bar"></span>
      <span class="btn-bar"></span>
      <span class="btn-bar"></span>
    </button>
  </div>
</div>

<nav class="site-nav">
  

  
    <ul id="menu" class="menu">
      
        
        <li class="menu-item menu-item-home">
          <a href="/" rel="section">
            
              <i class="menu-item-icon fa fa-fw fa-home"></i> <br />
            
            首页
          </a>
        </li>
      
        
        <li class="menu-item menu-item-about">
          <a href="/about/" rel="section">
            
              <i class="menu-item-icon fa fa-fw fa-user"></i> <br />
            
            关于
          </a>
        </li>
      
        
        <li class="menu-item menu-item-tags">
          <a href="/tags/" rel="section">
            
              <i class="menu-item-icon fa fa-fw fa-tags"></i> <br />
            
            标签
          </a>
        </li>
      
        
        <li class="menu-item menu-item-categories">
          <a href="/categories/" rel="section">
            
              <i class="menu-item-icon fa fa-fw fa-th"></i> <br />
            
            分类
          </a>
        </li>
      
        
        <li class="menu-item menu-item-archives">
          <a href="/archives/" rel="section">
            
              <i class="menu-item-icon fa fa-fw fa-archive"></i> <br />
            
            归档
          </a>
        </li>
      

      
    </ul>
  

  
</nav>



 </div>
    </header>

    <main id="main" class="main">
      <div class="main-inner">
        <div class="content-wrap">
          <div id="content" class="content">
            

  <div id="posts" class="posts-expand">
    

  

  
  
  

  <article class="post post-type-normal" itemscope itemtype="http://schema.org/Article">
  
  
  
  <div class="post-block">
    <link itemprop="mainEntityOfPage" href="http://yoursite.com/2019/01/02/SpringSecurity/">

    <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
      <meta itemprop="name" content="xiehuan">
      <meta itemprop="description" content="">
      <meta itemprop="image" content="/images/avatar.gif">
    </span>

    <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
      <meta itemprop="name" content="xiehuan">
    </span>

    
      <header class="post-header">

        
        
          <h1 class="post-title" itemprop="name headline">SpringSecurity</h1>
        

        <div class="post-meta">
          <span class="post-time">
            
              <span class="post-meta-item-icon">
                <i class="fa fa-calendar-o"></i>
              </span>
              
                <span class="post-meta-item-text">发表于</span>
              
              <time title="创建于" itemprop="dateCreated datePublished" datetime="2019-01-02T15:41:19+08:00">
                2019-01-02
              </time>
            

            

            
          </span>

          
            <span class="post-category" >
            
              <span class="post-meta-divider">|</span>
            
              <span class="post-meta-item-icon">
                <i class="fa fa-folder-o"></i>
              </span>
              
                <span class="post-meta-item-text">分类于</span>
              
              
                <span itemprop="about" itemscope itemtype="http://schema.org/Thing">
                  <a href="/categories/Java/" itemprop="url" rel="index">
                    <span itemprop="name">Java</span>
                  </a>
                </span>

                
                
              
            </span>
          

          
            
          

          
          

          

          

          

        </div>
      </header>
    

    
    
    
    <div class="post-body" itemprop="articleBody">

      
      

      
        <p>Spring Security 学习中的一些记录<br><a id="more"></a></p>
<h1 id="1-过滤器链"><a href="#1-过滤器链" class="headerlink" title="1 过滤器链"></a>1 过滤器链</h1><p><img src="/2019/01/02/SpringSecurity/1.png" alt="过滤器链"></p>
<h1 id="2-认证"><a href="#2-认证" class="headerlink" title="2 认证"></a>2 认证</h1><h2 id="2-1-UsernamePasswordAuthenticationFilter"><a href="#2-1-UsernamePasswordAuthenticationFilter" class="headerlink" title="2.1 UsernamePasswordAuthenticationFilter"></a>2.1 UsernamePasswordAuthenticationFilter</h2><p>继承AbstractAuthenticationProcessingFilter类。<br>attemptAuthentication方法<br><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">//取出用户名和密码</span><br><span class="line">String username = obtainUsername(request);</span><br><span class="line">String password = obtainPassword(request);</span><br><span class="line">//构造一个UsernamePasswordAuthenticationToken(Authentication接口的实例)</span><br><span class="line">UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(</span><br><span class="line">		username, password);</span><br><span class="line">//把构造出来的UsernamePasswordAuthenticationToken交给AuthenticationManger</span><br><span class="line">return this.getAuthenticationManager().authenticate(authRequest);</span><br></pre></td></tr></table></figure></p>
<h2 id="2-2-AuthenticationManger"><a href="#2-2-AuthenticationManger" class="headerlink" title="2.2 AuthenticationManger"></a>2.2 AuthenticationManger</h2><p>验证管理器 但AuthenticationManager本身并不做具体的验证工作，AuthenticationManager持有一个AuthenticationProvider集合 AuthenticationProvider才是做验证工作的组件<br>AuthenticationManger是一个接口类，所以查询ProviderManager（这是它的实现类），ProviderManager类的在authenticate方法源码<br><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br><span class="line">76</span><br><span class="line">77</span><br><span class="line">78</span><br><span class="line">79</span><br><span class="line">80</span><br><span class="line">81</span><br><span class="line">82</span><br><span class="line">83</span><br></pre></td><td class="code"><pre><span class="line">Class&lt;? extends Authentication&gt; toTest = authentication.getClass();</span><br><span class="line">AuthenticationException lastException = null;</span><br><span class="line">Authentication result = null;</span><br><span class="line">Authentication parentResult = null;</span><br><span class="line">boolean debug = logger.isDebugEnabled();</span><br><span class="line"></span><br><span class="line">for (AuthenticationProvider provider : getProviders()) &#123;</span><br><span class="line">	if (!provider.supports(toTest)) &#123;</span><br><span class="line">		continue;</span><br><span class="line">	&#125;</span><br><span class="line"></span><br><span class="line">	if (debug) &#123;</span><br><span class="line">		logger.debug(&quot;Authentication attempt using &quot;</span><br><span class="line">				+ provider.getClass().getName());</span><br><span class="line">	&#125;</span><br><span class="line"></span><br><span class="line">	try &#123;</span><br><span class="line">		result = provider.authenticate(authentication);</span><br><span class="line"></span><br><span class="line">		if (result != null) &#123;</span><br><span class="line">			copyDetails(authentication, result);</span><br><span class="line">			break;</span><br><span class="line">		&#125;</span><br><span class="line">	&#125;</span><br><span class="line">	catch (AccountStatusException e) &#123;</span><br><span class="line">		prepareException(e, authentication);</span><br><span class="line">		// SEC-546: Avoid polling additional providers if auth failure is due to</span><br><span class="line">		// invalid account status</span><br><span class="line">		throw e;</span><br><span class="line">	&#125;</span><br><span class="line">	catch (InternalAuthenticationServiceException e) &#123;</span><br><span class="line">		prepareException(e, authentication);</span><br><span class="line">		throw e;</span><br><span class="line">	&#125;</span><br><span class="line">	catch (AuthenticationException e) &#123;</span><br><span class="line">		lastException = e;</span><br><span class="line">	&#125;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line">if (result == null &amp;&amp; parent != null) &#123;</span><br><span class="line">	// Allow the parent to try.</span><br><span class="line">	try &#123;</span><br><span class="line">		result = parentResult = parent.authenticate(authentication);</span><br><span class="line">	&#125;</span><br><span class="line">	catch (ProviderNotFoundException e) &#123;</span><br><span class="line">		// ignore as we will throw below if no other exception occurred prior to</span><br><span class="line">		// calling parent and the parent</span><br><span class="line">		// may throw ProviderNotFound even though a provider in the child already</span><br><span class="line">		// handled the request</span><br><span class="line">	&#125;</span><br><span class="line">	catch (AuthenticationException e) &#123;</span><br><span class="line">		lastException = e;</span><br><span class="line">	&#125;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line">if (result != null) &#123;</span><br><span class="line">	if (eraseCredentialsAfterAuthentication</span><br><span class="line">			&amp;&amp; (result instanceof CredentialsContainer)) &#123;</span><br><span class="line">		// Authentication is complete. Remove credentials and other secret data</span><br><span class="line">		// from authentication</span><br><span class="line">		((CredentialsContainer) result).eraseCredentials();</span><br><span class="line">	&#125;</span><br><span class="line"></span><br><span class="line">	// If the parent AuthenticationManager was attempted and successful than it will publish an AuthenticationSuccessEvent</span><br><span class="line">	// This check prevents a duplicate AuthenticationSuccessEvent if the parent AuthenticationManager already published it</span><br><span class="line">	if (parentResult == null) &#123;</span><br><span class="line">		eventPublisher.publishAuthenticationSuccess(result);</span><br><span class="line">	&#125;</span><br><span class="line">	return result;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line">// Parent was null, or didn&apos;t authenticate (or throw an exception).</span><br><span class="line"></span><br><span class="line">if (lastException == null) &#123;</span><br><span class="line">	lastException = new ProviderNotFoundException(messages.getMessage(</span><br><span class="line">			&quot;ProviderManager.providerNotFound&quot;,</span><br><span class="line">			new Object[] &#123; toTest.getName() &#125;,</span><br><span class="line">			&quot;No AuthenticationProvider found for &#123;0&#125;&quot;));</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line">prepareException(lastException, authentication);</span><br><span class="line"></span><br><span class="line">throw lastException;</span><br></pre></td></tr></table></figure></p>
<h2 id="2-3-AuthenticationProvider"><a href="#2-3-AuthenticationProvider" class="headerlink" title="2.3 AuthenticationProvider"></a>2.3 AuthenticationProvider</h2><p>AuthenticationProvider是一个接口类，AbstractUserDetailsAuthenticationProvider实现了AuthenticationProvider，DaoAuthenticationProvider继承AbstractUserDetailsAuthenticationProvider<br>。当我们没有指定使用关联的AuthenticationProvider对象时，会使用默认的 DaoAuthenticationProvider</p>
<h2 id="2-4-UserDetailsService"><a href="#2-4-UserDetailsService" class="headerlink" title="2.4 UserDetailsService"></a>2.4 UserDetailsService</h2><h2 id="2-5-UserDetals"><a href="#2-5-UserDetals" class="headerlink" title="2.5 UserDetals"></a>2.5 UserDetals</h2><h2 id="2-6-Authentication"><a href="#2-6-Authentication" class="headerlink" title="2.6 Authentication"></a>2.6 Authentication</h2>
      
    </div>
    
    
    

    

    

    

    <footer class="post-footer">
      
        <div class="post-tags">
          
            <a href="/tags/Spring/" rel="tag"># Spring</a>
          
            <a href="/tags/Java/" rel="tag"># Java</a>
          
            <a href="/tags/Spring-Security/" rel="tag"># Spring Security</a>
          
            <a href="/tags/安全/" rel="tag"># 安全</a>
          
        </div>
      

      
      
      

      
        <div class="post-nav">
          <div class="post-nav-next post-nav-item">
            
              <a href="/2019/01/01/ControllerAdvice与-ExceptionHandler/" rel="next" title="@ControllerAdvice与@ExceptionHandler">
                <i class="fa fa-chevron-left"></i> @ControllerAdvice与@ExceptionHandler
              </a>
            
          </div>

          <span class="post-nav-divider"></span>

          <div class="post-nav-prev post-nav-item">
            
              <a href="/2019/01/08/trie/" rel="prev" title="trie">
                trie <i class="fa fa-chevron-right"></i>
              </a>
            
          </div>
        </div>
      

      
      
    </footer>
  </div>
  
  
  
  </article>



    <div class="post-spread">
      
    </div>
  </div>


          </div>
          


          

  



        </div>
        
          
  
  <div class="sidebar-toggle">
    <div class="sidebar-toggle-line-wrap">
      <span class="sidebar-toggle-line sidebar-toggle-line-first"></span>
      <span class="sidebar-toggle-line sidebar-toggle-line-middle"></span>
      <span class="sidebar-toggle-line sidebar-toggle-line-last"></span>
    </div>
  </div>

  <aside id="sidebar" class="sidebar">
    
    <div class="sidebar-inner">

      

      
        <ul class="sidebar-nav motion-element">
          <li class="sidebar-nav-toc sidebar-nav-active" data-target="post-toc-wrap">
            文章目录
          </li>
          <li class="sidebar-nav-overview" data-target="site-overview-wrap">
            站点概览
          </li>
        </ul>
      

      <section class="site-overview-wrap sidebar-panel">
        <div class="site-overview">
          <div class="site-author motion-element" itemprop="author" itemscope itemtype="http://schema.org/Person">
            
              <p class="site-author-name" itemprop="name">xiehuan</p>
              <p class="site-description motion-element" itemprop="description"></p>
          </div>

          <nav class="site-state motion-element">

            
              <div class="site-state-item site-state-posts">
              
                <a href="/archives/">
              
                  <span class="site-state-item-count">28</span>
                  <span class="site-state-item-name">日志</span>
                </a>
              </div>
            

            
              
              
              <div class="site-state-item site-state-categories">
                
                  <span class="site-state-item-count">7</span>
                  <span class="site-state-item-name">分类</span>
                
              </div>
            

            
              
              
              <div class="site-state-item site-state-tags">
                
                  <span class="site-state-item-count">27</span>
                  <span class="site-state-item-name">标签</span>
                
              </div>
            

          </nav>

          

          

          
          

          
          

          

        </div>
      </section>

      
      <!--noindex-->
        <section class="post-toc-wrap motion-element sidebar-panel sidebar-panel-active">
          <div class="post-toc">

            
              
            

            
              <div class="post-toc-content"><ol class="nav"><li class="nav-item nav-level-1"><a class="nav-link" href="#1-过滤器链"><span class="nav-number">1.</span> <span class="nav-text">1 过滤器链</span></a></li><li class="nav-item nav-level-1"><a class="nav-link" href="#2-认证"><span class="nav-number">2.</span> <span class="nav-text">2 认证</span></a><ol class="nav-child"><li class="nav-item nav-level-2"><a class="nav-link" href="#2-1-UsernamePasswordAuthenticationFilter"><span class="nav-number">2.1.</span> <span class="nav-text">2.1 UsernamePasswordAuthenticationFilter</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#2-2-AuthenticationManger"><span class="nav-number">2.2.</span> <span class="nav-text">2.2 AuthenticationManger</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#2-3-AuthenticationProvider"><span class="nav-number">2.3.</span> <span class="nav-text">2.3 AuthenticationProvider</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#2-4-UserDetailsService"><span class="nav-number">2.4.</span> <span class="nav-text">2.4 UserDetailsService</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#2-5-UserDetals"><span class="nav-number">2.5.</span> <span class="nav-text">2.5 UserDetals</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#2-6-Authentication"><span class="nav-number">2.6.</span> <span class="nav-text">2.6 Authentication</span></a></li></ol></li></ol></div>
            

          </div>
        </section>
      <!--/noindex-->
      

      

    </div>
  </aside>


        
      </div>
    </main>

    <footer id="footer" class="footer">
      <div class="footer-inner">
        <div class="copyright">&copy; <span itemprop="copyrightYear">2020</span>
  <span class="with-love">
    <i class="fa fa-user"></i>
  </span>
  <span class="author" itemprop="copyrightHolder">xiehuan</span>

  
</div>


  <div class="powered-by">由 <a class="theme-link" target="_blank" href="https://hexo.io">Hexo</a> 强力驱动</div>



  <span class="post-meta-divider">|</span>



  <div class="theme-info">主题 &mdash; <a class="theme-link" target="_blank" href="https://github.com/iissnan/hexo-theme-next">NexT.Gemini</a> v5.1.4</div>




        







       <p>Hosted by <a href="https://pages.coding.me" style="font-weight: bold">Coding Pages</a></p>
      </div>
    </footer>

    
      <div class="back-to-top">
        <i class="fa fa-arrow-up"></i>
        
      </div>
    

    

  </div>

  

<script type="text/javascript">
  if (Object.prototype.toString.call(window.Promise) !== '[object Function]') {
    window.Promise = null;
  }
</script>









  












  
  
    <script type="text/javascript" src="/lib/jquery/index.js?v=2.1.3"></script>
  

  
  
    <script type="text/javascript" src="/lib/fastclick/lib/fastclick.min.js?v=1.0.6"></script>
  

  
  
    <script type="text/javascript" src="/lib/jquery_lazyload/jquery.lazyload.js?v=1.9.7"></script>
  

  
  
    <script type="text/javascript" src="/lib/velocity/velocity.min.js?v=1.2.1"></script>
  

  
  
    <script type="text/javascript" src="/lib/velocity/velocity.ui.min.js?v=1.2.1"></script>
  

  
  
    <script type="text/javascript" src="/lib/fancybox/source/jquery.fancybox.pack.js?v=2.1.5"></script>
  


  


  <script type="text/javascript" src="/js/src/utils.js?v=5.1.4"></script>

  <script type="text/javascript" src="/js/src/motion.js?v=5.1.4"></script>



  
  


  <script type="text/javascript" src="/js/src/affix.js?v=5.1.4"></script>

  <script type="text/javascript" src="/js/src/schemes/pisces.js?v=5.1.4"></script>



  
  <script type="text/javascript" src="/js/src/scrollspy.js?v=5.1.4"></script>
<script type="text/javascript" src="/js/src/post-details.js?v=5.1.4"></script>



  


  <script type="text/javascript" src="/js/src/bootstrap.js?v=5.1.4"></script>



  


  




	





  





  












  





  

  

  

  
  

  

  

  

</body>
</html>
